KEEP

The certificate (see certificate for general information) of a
certified file is divided into two parts, a portcullis and a
keep. These names come from castle lore. The keep is the strongest
and usually tallest tower of a castle from which the entire
courtyard can be surveyed by the defenders. The keep of a book is a
list of file names and check sums used after the book has been
included, to determine if the files read were (up to check sum)
those certified.

Once the portcullis is open, include-book can enter the book
and read the event forms therein. The non-local event forms are
in fact executed, extending the host theory. That may read in other
books. When that has been finished, the keep of the
certificate is inspected. The keep is a list of the book names
which are included (hereditarily through all subbooks) in the
certified book (including the certified book itself) together with
the check sums of the objects in those books at the time of
certification. We compare the check sums of the books just included
to the check sums of the books stored in the keep. If differences
are found then we know that the book or one of its subbooks has been
changed since certification.